To meet the requirement of attaching warnings to the subject of an email for known viral emails, the appropriate option to configure would be for handling virus-infected messages. Known viral emails are those that are positively identified as containing a virus by the anti-virus scanning mechanism.
This setting specifically deals with emails that have been identified as containing a virus, and configuring this will allow the engineer to attach warnings to the subject line of such emails, thereby complying with the audit requirement.